How I Delegated Google Dorking to Neural Network Agents

Anyone who has ever participated in bug bounty or conducted a security audit of their own web services knows this routine. You sit in a browser, methodically plugging search operators like site:example.com ext:env or filetype:log into the search, catching endless CAPTCHAs from Google, copying URLs, and manually sifting through hundreds of search result pages looking for forgotten configs.

The work is useful but excruciatingly tedious. During the process, 95% of the time is spent filtering out informational noise like old PDF manuals where the word "password" just happened to appear. Recently I came across a compact repository DorkAgent, whose author attempted to automate this entire pipeline using a combination of search API and language models.

Under the Hood

The project is written in Python and addresses two specific pain points: search engine CAPTCHAs and manual analysis of search results.

Instead of directly parsing HTML, which Google blocks after three queries, DorkAgent accesses search results through the Serper API. This service delivers clean JSON with search pages. The LLM agent then analyzes the batch of links and snippets it receives. The agent doesn't just search for text matches—it evaluates context: whether the found file shows signs of actual access key leaks, forgotten admin panels, or parameters for injections.

The architecture relies on the CrewAI library. Agent tasks and roles are split into modules, and structured output data is validated through Pydantic schemas.

Which Models It Works With

In early versions, the script was tightly coupled to a single model, but by version 1.4 the project was rewritten. Now provider selection is supported:

• OpenAI (GPT-4 family models)
• Anthropic Claude
• Google Gemini (including Gemini Flash 2.0, which has a free tier with generous limits)

The author added the ability to use a hybrid setup, where search tasks and final report synthesis can be distributed between different networks. If you don't want to spend balance on paid APIs, the Serper + Gemini Flash combination costs literally pennies at the start.

How to Run

The tool's entry barrier is minimized. On first launch, the script automatically checks the environment and pulls in missing packages, then in interactive mode asks for keys and saves them to a local .env.

Clone the repository and run the main script:

git clone https://github.com/yee-yore/DorkAgent.git
cd DorkAgent
python dorkagent.py

To work, you'll need a token from serper.dev and at least one LLM key (for example, GEMINI_API_KEY or OPENAI_API_KEY).

What It Can Do in Practice

After startup, the agent runs a set of typical dorks against the target domain. The changelog shows how the author refined the prompts and query list: removed junk dorks for searching documents with the word "Confidential", added templates for finding IIS Windows Server panels and configs.

During execution, the agent generates a structured report:

• Classifies found leaks by risk level.
• Highlights vulnerable parameters and potential payloads in URLs.
• Saves the result to a separate file with a timestamp like YYMMDD_HHMMSS.

Search settings can be tweaked to your needs. For example, in serper_dev_tool.py you can adjust the selection depth and indexing time range:

# Поиск за последний месяц (qdr:m) или неделю (qdr:w)
payload = json.dumps({
    "q": search_query, 
    "num": self.n_results, 
    "tbs": "qdr:m"
})

This is convenient if you're monitoring the appearance of new subdomains or recent leaks for a specific company over the past couple of weeks.

The Catch

The repository is still small, with only about three hundred stars. The README documentation is modest, and some nuances have to be looked up directly in the source code tasks.py and agents.py.

If you want to add your own specific dorks, there's no ready-made config file in YAML or JSON. You'll need to dig into the code of the task() function and manually write query templates. You also need to keep in mind Serper's limits: the free query pool is enough for testing, but for deep scanning of a wide scope you'll need to top up your account.

Is It Worth Trying

DorkAgent will be useful in two cases. First, if you're doing OSINT or pentesting and are tired of manually clicking through search results. Second, if you want to see a real example of how CrewAI is applied to practical security tasks, rather than abstract article writing or text summarization.

The code is clean, split into understandable modules config.py, agents.py, tasks.py, and utils.py, so it's easy to fork and adapt for your own reconnaissance pipelines.